Hi ,
I need your help to understand the concept around oplock.
While working on oplock I have found that the call FltOplockFsctrl() is returning FLT_PREOP_PENDING.
But it remains so for over 600sec ,in end the status of IRP (FSCTL) is seen to the CANCELLED on Process monitor.
The requsted code is FSCTL_REQUEST_OPLOCK , that is called by a process on local matchine.
Also there is no parallel access , the reference count is 1 on FCB.
though FltCurrentOplock() returns TRUE for the Oplock pointer.
The product is shadow file object based encryption driver.
The code for this fsctl callback is matching with the sample “fastfat”.
please help me to understand the problem.
Thanks in advance.
Regards,
Maneesh
Do you understand how oplocks work? You might want to refresh your
knowledge…
But it remains so for over 600sec ,in end the status of IRP (FSCTL) is
seen to the CANCELLED on Process monitor.
This seems completely reasonable to me.
FileTest had some pretty funky extensions added recently (in the last 5
years 
to poke at oplocks. I’d start there.
/Rod
If you request an oplock and your FO is opened for synchronous I/O this function will not grant the oplock.
use this FsRtlCheckOplock () Every time you processes an operation that could cause an oplock break this is to check if the current operation breaks the oplock so you can block until the break is acknowledged.and this is what happening in your case.